add key attestations #389
add key attestations #389
Conversation
c2bo
left a comment
c2bo
left a comment
There was a problem hiding this comment.
I like it as a first draft and added some general comments.
General question: The plan would be to describe the overall mechanism in an Appendix and reference in Credential Endpoint (additional parameter for a Credential Request) and in Credential Issuer Metadata (to signal this is required for specific credential configurations)?
peppelinux
left a comment
peppelinux
left a comment
There was a problem hiding this comment.
good one @paulbastian , I support and follow this work, thank you
Co-authored-by: Giuseppe De Marco <demarcog83@gmail.com>
|
Is it possible to add description to the PR what this PR does and which issues it touches upon? thank you |
Sakurann
left a comment
Sakurann
left a comment
There was a problem hiding this comment.
my big question to this PR is where in the request do I put this key attestation needs to be defined, no?
|
I had the same question as @Sakurann as to where to put the key attestation. Moreover, if one attestation contains a list of keys, how can we provide one PoP for each key, and how to figure out which PoP corresponds to which key in the keys array. |
Co-authored-by: Christian Bormann <8774236+c2bo@users.noreply.github.com>
Co-authored-by: Kristina <52878547+Sakurann@users.noreply.github.com>
peppelinux
left a comment
peppelinux
left a comment
There was a problem hiding this comment.
I have provided additional comments, some editorial and others requesting further clarification for the readers. I can approve this regardless, as it appears to be very well done to me.
bj-ms
left a comment
bj-ms
left a comment
There was a problem hiding this comment.
Just added a comment about identifiers in key attestation JWTs, otherwise I find it to be a good extension to the specification!
| "iss": "<identifier of the issuer of this key attestation>", | ||
| "iat": 1516247022, |
There was a problem hiding this comment.
Isn't that an information that we could get from the key attestation certificate from the key storage/WSCD, if necessary?
I would expect a wallet to already have an internal mapping with identifiers between key attestation jwts and the location where the key resides.
Co-authored-by: Giuseppe De Marco <demarcog83@gmail.com>
| There are two ways to convey key attestations during Credential issuance: | ||
| - The Wallet uses the `jwt` proof type in the Credential Request to create a proof of possession of the key and adds the key attestation in the JOSE header as specified in (#jwt-proof-type). | ||
| - The Wallet uses the `attestation` proof type in the Credential Request with the key attestation without a proof of possession of the key itself as specified in (#attestation-proof-type). |
There was a problem hiding this comment.
todo: move this part to the proof type section
Co-authored-by: Kristina <52878547+Sakurann@users.noreply.github.com>
Closes #355
Closes #368
Closes #215
Closes #150